Every new exploit,
on the radar.

Laboratory validation of CVE-2026-48282 in Adobe ColdFusion RDS, covering arbitrary CFM file write, code execution as the ColdFusion service user, auditd and P…

Reproducer for CVE-2026-46585: Apache Camel camel-lucene QUERY header injection enabling authorization bypass / index data exfiltration (fixed in 4.14.8/4.18.3…

This repository provides a learning environment to understand how an Exim RCE exploit for CVE-2018-6789 works.

PoC materials to exploit CVE-2018-6789

Exim < 4.90.1 RCE Vulnerability remake for Python3 with arguments passed from CLI

CVE-2018-6789

CVE-2026-15410 - More: https://github.com/HORKimhab/poc-cve-collection

This comprehensive package contains everything needed to detect, analyze, and remediate Ripple20 (CVE-2020-11898) vulnerabilities in your organization.

CVE-2025-60357- NoSQL(MongoDB) Injection POC

CVE-2025-27591 is a privilege escalation vulnerability that affected the Below service before version 0.9.0

self cleaning CVE-2025-27591 Poc that grants a root reverse shell instead of modifying passwd files

CVE-2025-27591

CVE-2025-27591 is a known privilege escalation vulnerability in the Below service (version < v0.9.0)

A Proof of Concept for CVE-2025-27591, a local privilege escalation in Below < v0.9.0

Below v0.8.1 - Local Privilege Escalation (CVE-2025-27591) - PoC Exploit

a C exploit for CVE-2025-27591, which allow an attacker to escalate privilege to root.

🔥 Local Privilege Escalation Exploit for CVE-2025-27591 | Abuses world-writable log dir in Below to gain root via /etc/passwd injection

Remote Code Execution (RCE) in Yamcs Mission Control System via Java Statement Injection in Yarch SQL Double-Quoted IdentifiersRemote Code Execution (RCE) in Y…

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application that allows an attacker to perform unauthorized modifications to …

A stored Cross‑Site Scripting vulnerability exists in xxl-job-admin JobInfoController.java where the addressList parameter accepts unsanitized URL‑encoded Java…

CVE-2026-51833 Advisory

Integer overflow in FreeType software, which also affects Chrome

POC for CVE-2021-35448 based on https://www.exploit-db.com/exploits/49601

Multiple CVEs (CVE-2026-38934, CVE-2026-38935, CVE-2026-38936) discovered in diskover-community including CSRF and XSS vulnerabilities with proof-of-concept an…

will be published

Local Privilege Escalation PoC to pop a SYSTEM shell for CVE-2019-9702 in Symantec Encryption Desktop.

CVE-2024-28397: js2py sandbox escape, bypass pyimport restriction.

This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB).

This vulnerability arises from incomplete sandboxing in js2py, where crafted JavaScript can traverse Python’s internal object model and access dangerous classe…

A Python automation script for exploiting the **js2py Sandbox Escape** vulnerability (CVE-2024-28397). This tool automates the payload generation and delivery …

Professional exploit for CVE-2024-28397: Js2Py Sandbox Escape leading to Remote Code Execution (RCE). Includes modular payload generation.

Reverse shell for CVE-2024-28397.

A Bash script to check if systems are vulnerable to ICMP Timestamp Request Remote Date Disclosure (CVE-1999-0524).

POC of CVE-1999-0524

A reconnaissance tool to detect CVE-1999-0524 (ICMP Timestamp Disclosure) by automating timestamp extraction via nping or hping3. Converts raw ICMP timestamps …

Proof of Concept for CVE-2019-18634

A functional exploit for CVE-2019-18634, a BSS overflow in sudo's pwfeedback feature that allows for for privesc

My n-day exploit for CVE-2019-18634 (local privilege escalation)

A reproduction of CVE-2019-18634, sudo privilege escalation with buffer overflow.

An Python Exploit for Sudo vulnerability CVE-2019-18634

exploit for sudo CVE-2019-18634

exploit

There is a SQL injection vulnerability in the backend of Ruoyi v4.8.3

CVE-2023-38646 Metabase RCE

Automatic Tools For Metabase Exploit Known As CVE-2023-38646

POC for CVE-2023-38646

Metabase Pre-auth RCE (CVE-2023-38646)!!

Metabase Pre-auth RCE

Exploit script for Pre-Auth RCE in Metabase (CVE-2023-38646)

Metabase Pre-auth RCE (CVE-2023-38646)

For educational purposes only